Critical Security Update for OpenEXR: Addressing Arbitrary Code Execution and Information Disclosure Vulnerabilities
Summary
ALSA-2026:38498: Important: openexr security update. Affects openexr versions < 3.1.1-3.el9_8.3. Fixed in 3.1.1-3.el9_8.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenEXR is an open-source high-dynamic-range floating-point image file format designed for high-quality image processing and storage. It is widely used in visual effects and animation due to its ability to handle complex image data. The package includes binaries necessary for utilizing OpenEXR in various applications. However, recent vulnerabilities have been identified that could compromise the integrity and confidentiality of systems utilizing this package.
Vulnerability Detail
The vulnerabilities in OpenEXR stem from an integer overflow during image resizing, which can lead to arbitrary code execution (CVE-2026-41142). Additionally, malformed EXR files can cause information disclosure and denial of service (CVE-2026-42216). These vulnerabilities can be exploited by attackers to execute malicious code or disrupt service, posing significant risks to users and systems relying on OpenEXR.
How To Fix
Minimum fixed version
3.1.1-3.el9_8.3
This is the first release that contains the fix.
sudo dnf update openexrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the OpenEXR files or disabling features that utilize OpenEXR until the update can be applied. This can help mitigate potential exploitation while a permanent fix is being implemented.
Conclusion
The identified vulnerabilities in OpenEXR pose serious risks that can lead to arbitrary code execution and information disclosure. It is crucial for users to update their packages to the latest version to mitigate these risks effectively. By following the outlined steps, users can ensure their systems remain secure.
See every vulnerability recorded for openexr →
FAQ
The main vulnerabilities include arbitrary code execution due to integer overflow and information disclosure/denial of service from malformed EXR files.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Consider implementing workarounds such as restricting access to OpenEXR files or disabling related features until you can apply the update.
Exploitation of these vulnerabilities can lead to unauthorized code execution, data breaches, and service disruptions, affecting the security and reliability of applications using OpenEXR.
For detailed information, refer to the CVE pages: CVE-2026-41142 and CVE-2026-42216.
Related vulnerabilities
Recent vulnerabilities recorded for openexr.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
